Safeguard Audit Service Manual (G06.29+, H06.08+, J06.03+)

SAFEART Field Descriptions

Safeguard Audit Service Manual — 520480-031

7 - 78

OSS Link Record

A link record is generated whenever the link count of a file is changed due to

operations such as link() and unlink(). However, if the link count becomes zero, a File

Attributes record is generated instead.

These fields appear in the text area representing the Link record:

OssLinkCount

specifies the number of links. Field type is numeric.

OssLinkPathName

specifies the pathname of the file. This field is not present if the link count is not

zero and the operation is unlink(). Field type is character.

OSS Open Record

An open record is generated whenever a file residing in an audited fileset is opened.

This field appears in the text area representing the Open record:

OssOpenFlags

specifies the flags used to open the file. SAFEART displays this field in octal,

prefixed by a 0 (zero). These flags indicate the type of access, special open

processing, the type of update, and the initial state of the open file. The flag is

constructed by logically ORing special open processing flags. These flags are

defined in the <fcntl.h> header file. For more information, see the Open System

Services System Calls Reference Manual.

OSS Process Group ID Record

A Process Group ID record is generated whenever there is a change in the process

group ID (pgid) of a process. Setpgid(), setsid() and setpgrp( ) can change the process

group ID. The change generates a pair of secondary records, one to represent the

process group ID before the change and one to represent the changed process group

ID.

Process Group ID records are also generated during OSS process startup. In this

case, a new secondary record is generated that represents the process group ID to

which this newly created process belongs.

This field appears in the text area representing the Process Group ID record:

OssProcGroupID

specifies the Process Group ID. Field type is numeric.

Note. The setpgrp() function is supported only on systems running J06.03 and later J-series

RVUs, H06.14 and later H-series RVUs, and G06.32 and later G-series RVUs.